[comp.sys.mac] Is there a virus in PUKE init?

dyker@boulder.Colorado.EDU (Barbara Dyker) (04/15/88)

There is a viscious rumor going around our company that PUKE init,
specifically, carries a destructive virus or ailment.  The nature of
the beast is said to to be a time bomb of sorts in that after x times
shutting down (eject all) the beast begins to randomly write to the
startup disk.

This has gone so far here as an official memorandum from management
to require the extradition of this resource.  Many of us, myself
included have become very fond of the resounding barfing sound when
ejecting disks.  I have examined PUKE init with ResEdit and have not
found anything suspicious.

If anyone has any info about possible problems with this resource,
please e-mail to me.

Thanx.


Barbara J. Dyker              {nbires,ncar,sunybcs,ucbcad,utah-cs}!boulder!dyker
working for *just* another              dyker@boulder.Colorado.EDU
aerospace company

dplatt@coherent.com (Dave Platt) (04/16/88)

When I first acquired a copy of MacPuke, I installed it on a Mac Plus
running System 3.2 and immediately began having problems with floppy
disk I/O.  Symptoms included a failure to eject the disk, strange
(prolonged) whirring and clicking during I/O, and damage to the disk
contents requiring reinitialization (Disk First Aid might have salvaged
the disk;  I didn't try, as its contents weren't important).

Needless to say, I deinstalled the INIT!  I posted a note about the
problems I'd have onto the EchoMac news-echo on FidoNet, and received
a couple of responses from people who were using MacPuke with System 4.1
with no difficulty.

I have since tested MacPuke on Mac SE and II machines under System 4.2,
and have had no problems (aside from a horrified look from my wife, who
finds "the sound" thoroughly nauseating).  A friend of mine did have a
problem after he installed it in a Mac SE that his employer was taking
to the San Francisco MacWorld Expo earlier this year... somebody stole
the SE!  This is clearly a wetware bug.

My supposition is that MacPuke is patching itself into the disk I/O
path via some mechanism that works properly under System 4.x, but
somehow graunches the floppy-disk driver's context under System 3.2,
leading to destruction of disks when used in this environment.  This
sort of problem may be the source of the rumor that MacPuke contains
a disk-eating virus/trojan-horse/time-bomb.

-- 
Dave Platt                                             VOICE: (415) 493-8805
  USNAIL: Coherent Thought Inc.  3350 West Bayshore #205  Palo Alto CA 94303
  UUCP: ...!{ames,sun,uunet}!coherent!dplatt     DOMAIN: dplatt@coherent.com
  INTERNET:   coherent!dplatt@ames.arpa,    ...@sun.com,    ...@uunet.uu.net

moriarty@tc.fluke.COM (Jeff Meyer) (04/18/88)

It's always possible someone put a virus into MacPuke, but there is a way to
tell -- there's a new DA called Virus Detective which examines files for
various things.  It has some documentation on detecting nVIR and the Case
virus, supposedly.  I'll upload it to comp.mac.binaries (please, no e-mail
requests for a copy -- I don't want to be a clearing house for these
things).

Frankly, I think the whole issue is ridiculously hyped, but there are some
nice tools coming out for detecting these things.  Besides, Vaccine is a
pretty good general purpose detector.

                            "So that's it in a nutshell,
                             Phil.  We're here to take
                             over your planet and enslave
                             all you goobers what live
                             here..."
                                                   "Never mind that -- what
                                                    about *women's issues*?
                                                    What do you think about
                                                    equal pay?  I could just
                                                    weep!"

-- 
                                        Moriarty, aka Jeff Meyer
INTERNET:     moriarty@tc.fluke.COM
Manual UUCP:  {uw-beaver, sun, microsoft}!fluke!moriarty
CREDO:        You gotta be Cruel to be Kind...
<*> DISCLAIMER: Do what you want with me, but leave my employers alone! <*>

THJ@PSUVM.BITNET (William J. Sproule Jr.) (04/22/88)

There has been rumors of a virus in MacPuke here at PSU also.  It was reported
in one of our public labs.  I have not had time to check it out, but
I have been told someone has hacked the code.  I will post more as I get
info and have a chance to look at the beast.


Bill Sproule
bitnet thj@psuvm
uucp: ...psuvax1!psuvm.BITNET!thj
(814) 863-4356